[Swfdec] [Bug 16822] New: segmentation fault in mozilla plugin

[bugzilla-daemon at freedesktop.org]

http://bugs.freedesktop.org/show_bug.cgi?id=16822

           Summary: segmentation fault in mozilla plugin
           Product: swfdec
           Version: git
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: blocker
          Priority: medium
         Component: plugin
        AssignedTo: swfdec at lists.freedesktop.org
        ReportedBy: riccardo at datahost.it
         QAContact: swfdec at lists.freedesktop.org


How to reproduce:

- Open the properties dialog of swfmoz
- Close the associated tab in firefox
- Boom!

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7c3e6c0 (LWP 27014)]
0xb7793c59 in nsQueryInterface::operator() (this=<value optimized out>, 
    aIID=@0xb7921ed4, answer=0xbfa023f0) at nsCOMPtr.cpp:47
47      nsCOMPtr.cpp: No such file or directory.
        in nsCOMPtr.cpp
(gdb) bt full
#0  0xb7793c59 in nsQueryInterface::operator() (this=<value optimized out>, 
    aIID=@0xb7921ed4, answer=0xbfa023f0) at nsCOMPtr.cpp:47
        status = <value optimized out>
#1  0xb7793d11 in nsCOMPtr_base::assign_from_qi (this=0xbfa02438, qi=
      {mRawPtr = 0x10001000}, iid=@0x10001000) at nsCOMPtr.cpp:96
        newRawPtr = <value optimized out>
#2  0xb76545f2 in _destroystream (npp=0xae87a6d8, pstream=0xae6195a0, reason=0)
    at ../../../../dist/include/xpcom/nsCOMPtr.h:645
        guard = {<PRCListStr> = {next = 0xb7a1b378, prev = 0xb7a1b378}, 
  mInstance = {<nsCOMPtr_base> = {mRawPtr = 0xb7bbdfe8}, <No data fields>}, 
  mDelayedDestroy = 0, static sListHead = {next = 0xbfa02428, 
    prev = 0xbfa02428}}
        listener = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}
#3  0xb281aef0 in plugin_destroy_stream (instance=0xae87a6d8, 
    stream=0xae6195a0) at plugin.c:79
No locals.
#4  0xb281db43 in swfmoz_loader_close (stream=0xadfcb408) at swfmoz_loader.c:88
No locals.
#5  0xafda319e in swfdec_stream_ensure_closed (stream=0xadfcb408)
    at swfdec_stream.c:267
        priv = (SwfdecStreamPrivate *) 0xadfcb438
        __PRETTY_FUNCTION__ = "swfdec_stream_ensure_closed"
#6  0xafd816c5 in swfdec_net_stream_set_loader (stream=0xae684520, loader=0x0)
---Type <return> to continue, or q <return> to quit---
    at swfdec_net_stream.c:650
        __PRETTY_FUNCTION__ = "swfdec_net_stream_set_loader"
#7  0xafd821cc in swfdec_net_stream_dispose (object=0xae684520)
    at swfdec_net_stream.c:471
        stream = (SwfdecNetStream *) 0xae684520
        __PRETTY_FUNCTION__ = "swfdec_net_stream_dispose"
#8  0xb6afa9e8 in IA__g_object_unref (_object=0xae684520)
    at /tmp/buildd/glib2.0-2.16.4/gobject/gobject.c:1765
        object = (GObject *) 0xae684520
        __PRETTY_FUNCTION__ = "IA__g_object_unref"
#9  0xafd510de in swfdec_as_object_collect (object=0xae684520)
    at swfdec_as_object.c:828
        __PRETTY_FUNCTION__ = "swfdec_as_object_collect"
#10 0xafd3fe62 in swfdec_as_context_remove_objects (key=0xae684520, 
    value=0xae684520, debugger=0x0) at swfdec_as_context.c:297
        __PRETTY_FUNCTION__ = "swfdec_as_context_remove_objects"
#11 0xb6a64bd5 in g_hash_table_foreach_remove_or_steal (hash_table=0xb2dcfa78, 
    func=0xafd3fd60 <swfdec_as_context_remove_objects>, user_data=0x0, 
    notify=1) at /tmp/buildd/glib2.0-2.16.4/glib/ghash.c:975
        node = (GHashNode *) 0xae081d20
        node_ptr = (GHashNode **) 0xacd1f290
        deleted = 11633
        i = 12452


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.